Merge remote-tracking branch 'upstream/develop' into password_setup

# Conflicts:
#	.travis.yml
This commit is contained in:
VakarisZ 2020-06-25 10:04:04 +03:00
commit 7462c1c701
21 changed files with 613 additions and 10 deletions

View File

@ -65,7 +65,7 @@ script:
- cd monkey_island/cc/ui
- npm ci # See https://docs.npmjs.com/cli/ci.html
- eslint ./src --quiet # Test for errors
- JS_WARNINGS_AMOUNT_UPPER_LIMIT=500
- JS_WARNINGS_AMOUNT_UPPER_LIMIT=90
- eslint ./src --max-warnings $JS_WARNINGS_AMOUNT_UPPER_LIMIT # Test for max warnings
after_success:

View File

@ -1,3 +1,5 @@
POST_BREACH_COMMUNICATE_AS_NEW_USER = "Communicate as new user"
POST_BREACH_BACKDOOR_USER = "Backdoor user"
POST_BREACH_FILE_EXECUTION = "File execution"
POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION = "Modify shell startup file"
POST_BREACH_HIDDEN_FILES = "Hide files and directories"

View File

@ -0,0 +1,37 @@
from common.data.post_breach_consts import POST_BREACH_HIDDEN_FILES
from infection_monkey.post_breach.pba import PBA
from infection_monkey.telemetry.post_breach_telem import PostBreachTelem
from infection_monkey.utils.hidden_files import\
get_commands_to_hide_files,\
get_commands_to_hide_folders,\
cleanup_hidden_files,\
get_winAPI_to_hide_files
from infection_monkey.utils.environment import is_windows_os
HIDDEN_FSO_CREATION_COMMANDS = [get_commands_to_hide_files,
get_commands_to_hide_folders]
class HiddenFiles(PBA):
"""
This PBA attempts to create hidden files and folders.
"""
def __init__(self):
super(HiddenFiles, self).__init__(name=POST_BREACH_HIDDEN_FILES)
def run(self):
# create hidden files and folders
for function_to_get_commands in HIDDEN_FSO_CREATION_COMMANDS:
linux_cmds, windows_cmds = function_to_get_commands()
super(HiddenFiles, self).__init__(name=POST_BREACH_HIDDEN_FILES,
linux_cmd=' '.join(linux_cmds),
windows_cmd=windows_cmds)
super(HiddenFiles, self).run()
if is_windows_os(): # use winAPI
result, status = get_winAPI_to_hide_files()
PostBreachTelem(self, (result, status)).send()
# cleanup hidden files and folders
cleanup_hidden_files(is_windows_os())

View File

@ -0,0 +1,44 @@
from common.data.post_breach_consts import POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
from infection_monkey.post_breach.pba import PBA
from infection_monkey.post_breach.shell_startup_files.shell_startup_files_modification import\
get_commands_to_modify_shell_startup_files
class ModifyShellStartupFiles(PBA):
"""
This PBA attempts to modify shell startup files,
like ~/.profile, ~/.bashrc, ~/.bash_profile in linux,
and profile.ps1 in windows.
"""
def run(self):
[pba.run() for pba in self.modify_shell_startup_PBA_list()]
def modify_shell_startup_PBA_list(self):
return ShellStartupPBAGenerator.get_modify_shell_startup_pbas()
class ShellStartupPBAGenerator():
def get_modify_shell_startup_pbas():
(cmds_for_linux, shell_startup_files_for_linux, usernames_for_linux),\
(cmds_for_windows, shell_startup_files_per_user_for_windows) = get_commands_to_modify_shell_startup_files()
pbas = []
for startup_file_per_user in shell_startup_files_per_user_for_windows:
windows_cmds = ' '.join(cmds_for_windows).format(startup_file_per_user)
pbas.append(ModifyShellStartupFile(linux_cmds='', windows_cmds=['powershell.exe', windows_cmds]))
for username in usernames_for_linux:
for shell_startup_file in shell_startup_files_for_linux:
linux_cmds = ' '.join(cmds_for_linux).format(shell_startup_file).format(username)
pbas.append(ModifyShellStartupFile(linux_cmds=linux_cmds, windows_cmds=''))
return pbas
class ModifyShellStartupFile(PBA):
def __init__(self, linux_cmds, windows_cmds):
super(ModifyShellStartupFile, self).__init__(name=POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION,
linux_cmd=linux_cmds,
windows_cmd=windows_cmds)

View File

@ -57,11 +57,12 @@ class PBA(Plugin):
"""
Runs post breach action command
"""
exec_funct = self._execute_default
result = exec_funct()
if self.scripts_were_used_successfully(result):
T1064Telem(ScanStatus.USED, "Scripts were used to execute %s post breach action." % self.name).send()
PostBreachTelem(self, result).send()
if self.command:
exec_funct = self._execute_default
result = exec_funct()
if self.scripts_were_used_successfully(result):
T1064Telem(ScanStatus.USED, "Scripts were used to execute %s post breach action." % self.name).send()
PostBreachTelem(self, result).send()
def is_script(self):
"""

View File

@ -0,0 +1,39 @@
import subprocess
from infection_monkey.utils.environment import is_windows_os
def get_linux_commands_to_modify_shell_startup_files():
if is_windows_os():
return '', [], []
HOME_DIR = "/home/"
# get list of usernames
USERS = subprocess.check_output( # noqa: DUO116
"cut -d: -f1,3 /etc/passwd | egrep ':[0-9]{4}$' | cut -d: -f1",
shell=True
).decode().split('\n')[:-1]
# get list of paths of different shell startup files with place for username
STARTUP_FILES = [
file_path.format(HOME_DIR) for file_path in
[
"{0}{{0}}/.profile", # bash, dash, ksh, sh
"{0}{{0}}/.bashrc", # bash
"{0}{{0}}/.bash_profile",
"{0}{{0}}/.config/fish/config.fish", # fish
"{0}{{0}}/.zshrc", # zsh
"{0}{{0}}/.zshenv",
"{0}{{0}}/.zprofile",
"{0}{{0}}/.kshrc", # ksh
"{0}{{0}}/.tcshrc", # tcsh
"{0}{{0}}/.cshrc", # csh
]
]
return [
'3<{0} 3<&- &&', # check for existence of file
'echo \"# Succesfully modified {0}\" |',
'tee -a {0} &&', # append to file
'sed -i \'$d\' {0}', # remove last line of file (undo changes)
], STARTUP_FILES, USERS

View File

@ -0,0 +1,10 @@
from infection_monkey.post_breach.shell_startup_files.linux.shell_startup_files_modification import\
get_linux_commands_to_modify_shell_startup_files
from infection_monkey.post_breach.shell_startup_files.windows.shell_startup_files_modification import\
get_windows_commands_to_modify_shell_startup_files
def get_commands_to_modify_shell_startup_files():
linux_cmds = get_linux_commands_to_modify_shell_startup_files()
windows_cmds = get_windows_commands_to_modify_shell_startup_files()
return linux_cmds, windows_cmds

View File

@ -0,0 +1,27 @@
import subprocess
from infection_monkey.utils.environment import is_windows_os
def get_windows_commands_to_modify_shell_startup_files():
if not is_windows_os():
return '', []
# get powershell startup file path
SHELL_STARTUP_FILE = subprocess.check_output('powershell $Profile').decode().split("\r\n")[0]
SHELL_STARTUP_FILE_PATH_COMPONENTS = SHELL_STARTUP_FILE.split("\\")
# get list of usernames
USERS = subprocess.check_output('dir C:\\Users /b', shell=True).decode().split("\r\n")[:-1] # noqa: DUO116
STARTUP_FILES_PER_USER = ['\\'.join(SHELL_STARTUP_FILE_PATH_COMPONENTS[:2] +
[user] +
SHELL_STARTUP_FILE_PATH_COMPONENTS[3:])
for user in USERS]
return [
'Add-Content {0}',
'\"# Successfully modified {0}\" ;', # add line to $profile
'cat {0} | Select -last 1 ;', # print last line of $profile
'$OldProfile = cat {0} | Select -skiplast 1 ;',
'Set-Content {0} -Value $OldProfile ;' # remove last line of $profile
], STARTUP_FILES_PER_USER

View File

@ -0,0 +1,29 @@
import subprocess
from infection_monkey.utils.linux.hidden_files import\
get_linux_commands_to_hide_files,\
get_linux_commands_to_hide_folders,\
get_linux_commands_to_delete
from infection_monkey.utils.windows.hidden_files import\
get_windows_commands_to_hide_files,\
get_windows_commands_to_hide_folders,\
get_winAPI_to_hide_files,\
get_windows_commands_to_delete
from infection_monkey.utils.environment import is_windows_os
def get_commands_to_hide_files():
linux_cmds = get_linux_commands_to_hide_files()
windows_cmds = get_windows_commands_to_hide_files()
return linux_cmds, windows_cmds
def get_commands_to_hide_folders():
linux_cmds = get_linux_commands_to_hide_folders()
windows_cmds = get_windows_commands_to_hide_folders()
return linux_cmds, windows_cmds
def cleanup_hidden_files(is_windows=is_windows_os()):
subprocess.run(get_windows_commands_to_delete() if is_windows # noqa: DUO116
else ' '.join(get_linux_commands_to_delete()),
shell=True)

View File

@ -0,0 +1,34 @@
HIDDEN_FILE = '$HOME/.monkey-hidden-file'
HIDDEN_FOLDER = '$HOME/.monkey-hidden-folder'
def get_linux_commands_to_hide_files():
return [
'touch', # create file
HIDDEN_FILE,
'&&'
'echo \"Successfully created hidden file: {}\" |'.format(HIDDEN_FILE), # output
'tee -a', # and write to file
HIDDEN_FILE
]
def get_linux_commands_to_hide_folders():
return [
'mkdir', # make directory
HIDDEN_FOLDER,
'&& touch', # create file
'{}/{}'.format(HIDDEN_FOLDER, 'some-file'), # random file in hidden folder
'&& echo \"Successfully created hidden folder: {}\" |'.format(HIDDEN_FOLDER), # output
'tee -a', # and write to file
'{}/{}'.format(HIDDEN_FOLDER, 'some-file') # random file in hidden folder
]
def get_linux_commands_to_delete():
return [
'rm', # remove
'-rf', # force delete recursively
HIDDEN_FILE,
HIDDEN_FOLDER
]

View File

@ -0,0 +1,81 @@
import os
HOME_PATH = os.path.expanduser("~")
HIDDEN_FILE = HOME_PATH + "\\monkey-hidden-file"
HIDDEN_FOLDER = HOME_PATH + "\\monkey-hidden-folder"
HIDDEN_FILE_WINAPI = HOME_PATH + "\\monkey-hidden-file-winAPI"
def get_windows_commands_to_hide_files():
return [
'echo',
'Successfully created hidden file: {}'.format(HIDDEN_FILE), # create empty file
'>',
HIDDEN_FILE,
'&&',
'attrib', # change file attributes
'+h', # hidden attribute
'+s', # system attribute
HIDDEN_FILE,
'&&',
'type',
HIDDEN_FILE
]
def get_windows_commands_to_hide_folders():
return [
'mkdir',
HIDDEN_FOLDER, # make directory
'&&',
'attrib',
'+h', # hidden attribute
'+s', # system attribute
HIDDEN_FOLDER, # change file attributes
'&&',
'echo',
'Successfully created hidden folder: {}'.format(HIDDEN_FOLDER),
'>',
'{}\\{}'.format(HIDDEN_FOLDER, 'some-file'),
'&&',
'type',
'{}\\{}'.format(HIDDEN_FOLDER, 'some-file')
]
def get_winAPI_to_hide_files():
import win32file
try:
fileAccess = win32file.GENERIC_READ | win32file.GENERIC_WRITE # read-write access
fileCreation = win32file.CREATE_ALWAYS # overwrite existing file
fileFlags = win32file.FILE_ATTRIBUTE_HIDDEN # make hidden
hiddenFile = win32file.CreateFile(HIDDEN_FILE_WINAPI,
fileAccess,
0, # sharing mode: 0 => can't be shared
None, # security attributes
fileCreation,
fileFlags,
0) # template file
return "Succesfully created hidden file: {}".format(HIDDEN_FILE_WINAPI), True
except Exception as err:
return str(err), False
def get_windows_commands_to_delete():
return [
'powershell.exe',
'del', # delete file
'-Force',
HIDDEN_FILE,
',',
HIDDEN_FILE_WINAPI,
';',
'rmdir', # delete folder
'-Force',
'-Recurse',
HIDDEN_FOLDER
]

View File

@ -4,7 +4,7 @@ from monkey_island.cc.models import Monkey
from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082
from monkey_island.cc.services.attack.technique_reports import T1145, T1105, T1065, T1035, T1129, T1106, T1107, T1188
from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005, T1018, T1016, T1021, T1064
from monkey_island.cc.services.attack.technique_reports import T1136
from monkey_island.cc.services.attack.technique_reports import T1136, T1156, T1504, T1158
from monkey_island.cc.services.attack.attack_config import AttackConfig
from monkey_island.cc.database import mongo
from monkey_island.cc.services.reporting.report_generation_synchronisation import safe_generate_attack_report
@ -37,7 +37,10 @@ TECHNIQUES = {'T1210': T1210.T1210,
'T1016': T1016.T1016,
'T1021': T1021.T1021,
'T1064': T1064.T1064,
'T1136': T1136.T1136
'T1136': T1136.T1136,
'T1156': T1156.T1156,
'T1504': T1504.T1504,
'T1158': T1158.T1158
}
REPORT_NAME = 'new_report'

View File

@ -71,6 +71,16 @@ SCHEMA = {
"type": "object",
"link": "https://attack.mitre.org/tactics/TA0003/",
"properties": {
"T1156": {
"title": ".bash_profile and .bashrc",
"type": "bool",
"value": True,
"necessary": False,
"link": "https://attack.mitre.org/techniques/T1156",
"description": "Adversaries may abuse shell scripts by "
"inserting arbitrary shell commands to gain persistence, which "
"would be executed every time the user logs in or opens a new shell."
},
"T1136": {
"title": "Create account",
"type": "bool",
@ -79,6 +89,26 @@ SCHEMA = {
"link": "https://attack.mitre.org/techniques/T1136",
"description": "Adversaries with a sufficient level of access "
"may create a local system, domain, or cloud tenant account."
},
"T1158": {
"title": "Hidden files and directories",
"type": "bool",
"value": True,
"necessary": False,
"link": "https://attack.mitre.org/techniques/T1158",
"description": "Adversaries can hide files and folders on the system "
"and evade a typical user or system analysis that does not "
"incorporate investigation of hidden files."
},
"T1504": {
"title": "PowerShell profile",
"type": "bool",
"value": True,
"necessary": False,
"link": "https://attack.mitre.org/techniques/T1504",
"description": "Adversaries may gain persistence and elevate privileges "
"in certain situations by abusing PowerShell profiles which "
"are scripts that run when PowerShell starts."
}
}
},

View File

@ -0,0 +1,38 @@
from monkey_island.cc.services.attack.technique_reports import AttackTechnique
from monkey_island.cc.database import mongo
from common.utils.attack_utils import ScanStatus
from common.data.post_breach_consts import POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
__author__ = "shreyamalviya"
class T1156(AttackTechnique):
tech_id = "T1156"
unscanned_msg = "Monkey did not try modifying bash startup files on the system."
scanned_msg = "Monkey tried modifying bash startup files on the system but failed."
used_msg = "Monkey modified bash startup files on the system."
query = [{'$match': {'telem_category': 'post_breach',
'data.name': POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION,
'data.command': {'$regex': 'bash'}}},
{'$project': {'_id': 0,
'machine': {'hostname': '$data.hostname',
'ips': ['$data.ip']},
'result': '$data.result'}}]
@staticmethod
def get_report_data():
data = {'title': T1156.technique_title(), 'info': []}
bash_modification_info = list(mongo.db.telemetry.aggregate(T1156.query))
status = []
for pba_node in bash_modification_info:
status.append(pba_node['result'][1])
status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
if status else ScanStatus.UNSCANNED.value
data.update(T1156.get_base_data_by_status(status))
data.update({'info': bash_modification_info})
return data

View File

@ -0,0 +1,37 @@
from monkey_island.cc.services.attack.technique_reports import AttackTechnique
from monkey_island.cc.database import mongo
from common.utils.attack_utils import ScanStatus
from common.data.post_breach_consts import POST_BREACH_HIDDEN_FILES
__author__ = "shreyamalviya"
class T1158(AttackTechnique):
tech_id = "T1158"
unscanned_msg = "Monkey did not try creating hidden files or folders."
scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
used_msg = "Monkey created hidden files and folders on the system."
query = [{'$match': {'telem_category': 'post_breach',
'data.name': POST_BREACH_HIDDEN_FILES}},
{'$project': {'_id': 0,
'machine': {'hostname': '$data.hostname',
'ips': ['$data.ip']},
'result': '$data.result'}}]
@staticmethod
def get_report_data():
data = {'title': T1158.technique_title(), 'info': []}
hidden_file_info = list(mongo.db.telemetry.aggregate(T1158.query))
status = []
for pba_node in hidden_file_info:
status.append(pba_node['result'][1])
status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
if status else ScanStatus.UNSCANNED.value
data.update(T1158.get_base_data_by_status(status))
data.update({'info': hidden_file_info})
return data

View File

@ -0,0 +1,38 @@
from monkey_island.cc.services.attack.technique_reports import AttackTechnique
from monkey_island.cc.database import mongo
from common.utils.attack_utils import ScanStatus
from common.data.post_breach_consts import POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION
__author__ = "shreyamalviya"
class T1504(AttackTechnique):
tech_id = "T1504"
unscanned_msg = "Monkey did not try modifying powershell startup files on the system."
scanned_msg = "Monkey tried modifying powershell startup files on the system but failed."
used_msg = "Monkey modified powershell startup files on the system."
query = [{'$match': {'telem_category': 'post_breach',
'data.name': POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION,
'data.command': {'$regex': 'powershell'}}},
{'$project': {'_id': 0,
'machine': {'hostname': '$data.hostname',
'ips': ['$data.ip']},
'result': '$data.result'}}]
@staticmethod
def get_report_data():
data = {'title': T1504.technique_title(), 'info': []}
powershell_profile_modification_info = list(mongo.db.telemetry.aggregate(T1504.query))
status = []
for pba_node in powershell_profile_modification_info:
status.append(pba_node['result'][1])
status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
if status else ScanStatus.UNSCANNED.value
data.update(T1504.get_base_data_by_status(status))
data.update({'info': powershell_profile_modification_info})
return data

View File

@ -160,6 +160,22 @@ SCHEMA = {
"title": "Communicate as new user",
"attack_techniques": ["T1136"]
},
{
"type": "string",
"enum": [
"ModifyShellStartupFiles"
],
"title": "Modify shell startup files",
"attack_techniques": ["T1156", "T1504"]
},
{
"type": "string",
"enum": [
"HiddenFiles"
],
"title": "Hidden files and directories",
"attack_techniques": ["T1158"]
}
],
},
"finger_classes": {
@ -379,7 +395,9 @@ SCHEMA = {
},
"default": [
"BackdoorUser",
"CommunicateAsNewUser"
"CommunicateAsNewUser",
"ModifyShellStartupFiles",
"HiddenFiles"
],
"description": "List of actions the Monkey will run post breach"
},

View File

@ -53,7 +53,7 @@
"react/jsx-uses-react": 1,
"react/jsx-uses-vars": 1,
"react/jsx-key": 1,
"react/prop-types": 1,
"react/prop-types": 0,
"react/no-unescaped-entities": 1,
"react/no-unknown-property": [1, { "ignore": ["class"] }],
"react/no-string-refs": 1,

View File

@ -0,0 +1,45 @@
import React from 'react';
import ReactTable from 'react-table';
import {renderMachineFromSystemData, ScanStatus} from './Helpers';
import MitigationsComponent from './MitigationsComponent';
class T1156 extends React.Component {
constructor(props) {
super(props);
}
static getColumns() {
return ([{
columns: [
{ Header: 'Machine',
id: 'machine',
accessor: x => renderMachineFromSystemData(x.machine),
style: {'whiteSpace': 'unset'}},
{ Header: 'Result',
id: 'result',
accessor: x => x.result,
style: {'whiteSpace': 'unset'}}
]
}])
}
render() {
return (
<div>
<div>{this.props.data.message}</div>
<br/>
{this.props.data.status === ScanStatus.USED ?
<ReactTable
columns={T1156.getColumns()}
data={this.props.data.info}
showPagination={false}
defaultPageSize={this.props.data.info.length}
/> : ''}
<MitigationsComponent mitigations={this.props.data.mitigations}/>
</div>
);
}
}
export default T1156;

View File

@ -0,0 +1,45 @@
import React from 'react';
import ReactTable from 'react-table';
import {renderMachineFromSystemData, ScanStatus} from './Helpers';
import MitigationsComponent from './MitigationsComponent';
class T1158 extends React.Component {
constructor(props) {
super(props);
}
static getColumns() {
return ([{
columns: [
{ Header: 'Machine',
id: 'machine',
accessor: x => renderMachineFromSystemData(x.machine),
style: {'whiteSpace': 'unset'}},
{ Header: 'Result',
id: 'result',
accessor: x => x.result,
style: {'whiteSpace': 'unset'}}
]
}])
}
render() {
return (
<div>
<div>{this.props.data.message}</div>
<br/>
{this.props.data.status === ScanStatus.USED ?
<ReactTable
columns={T1158.getColumns()}
data={this.props.data.info}
showPagination={false}
defaultPageSize={this.props.data.info.length}
/> : ''}
<MitigationsComponent mitigations={this.props.data.mitigations}/>
</div>
);
}
}
export default T1158;

View File

@ -0,0 +1,45 @@
import React from 'react';
import ReactTable from 'react-table';
import {renderMachineFromSystemData, ScanStatus} from './Helpers';
import MitigationsComponent from './MitigationsComponent';
class T1504 extends React.Component {
constructor(props) {
super(props);
}
static getColumns() {
return ([{
columns: [
{ Header: 'Machine',
id: 'machine',
accessor: x => renderMachineFromSystemData(x.machine),
style: {'whiteSpace': 'unset'}},
{ Header: 'Result',
id: 'result',
accessor: x => x.result,
style: {'whiteSpace': 'unset'}}
]
}])
}
render() {
return (
<div>
<div>{this.props.data.message}</div>
<br/>
{this.props.data.status === ScanStatus.USED ?
<ReactTable
columns={T1504.getColumns()}
data={this.props.data.info}
showPagination={false}
defaultPageSize={this.props.data.info.length}
/> : ''}
<MitigationsComponent mitigations={this.props.data.mitigations}/>
</div>
);
}
}
export default T1504;